feat(packaging): build thin .deb and .rpm and attach them to releases (#913)

* feat(packaging): build thin .deb and .rpm with nfpm and attach them to releases

Adds packaging/native: an nfpm config that produces a .deb and an .rpm
from the release wheel. The packages stay thin - Python, GTK, PyGObject
and the typelibs are distro Depends; only pywhispercpp and pynput are
vendored because the first is unpackaged on both distros and the second
is missing on Fedora. The Debian 12 build image and the nfpm download
are pinned in tool_checksums.txt.

just native-packages builds both in the pinned container, and
native-smoke installs the built package per distro: debian:12 and
ubuntu:24.04 exercise the .deb, fedora:42 the .rpm, then each runs
vocalinux --version plus an import smoke of the app and the vendored
extension. unified-pipeline.yml gates on the same three-distro matrix,
and release.yml attaches both arches to the release and covers them in
SHA256SUMS and the provenance manifest.

Refs #600

* fix(packaging): preserve launcher args and document Wayland input group

The launcher joined $* into an unquoted exec, re-splitting file paths
that contain spaces before argparse saw them. Exec "$@" directly and
re-quote each argument for the inner shell of 'sg input -c'.

On Wayland the packages could not grant the 'input' group membership
evdev hotkeys need; name the usermod step and its caveat in INSTALL.md
and the release notes.

* test(packaging): add return types to the native packaging tests

---------

Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>

docs/RELEASE_PROCESS.md

@@ -168,7 +168,8 @@ Use these rules for every GitHub Release body (and for the draft pasted into the
 5. `## Bug Fixes` - group by area (IBus, Installer, AUR, Text injection, …)
 6. Optional: `## Improvements`, `## Docs`, `## Packaging`
 7. `## Thanks` - external PR authors and issue reporters by `@handle`
-8. `## Install / Upgrade` - `install.sh`, AUR, PyPI, **AppImage**, Flatpak, Snap
+8. `## Install / Upgrade` - `install.sh`, AUR, PyPI, **AppImage**, Flatpak, Snap,
+   `.deb` / `.rpm`
    (Store channels plus GitHub `.snap` sideload when Store review is pending)
 9. `### Verifying what you downloaded` (required, and easy to lose). `release.yml`
    generates it, with `sha256sum -c --ignore-missing SHA256SUMS` and
@@ -384,7 +385,8 @@ After pushing the tag, the GitHub Actions workflow will automatically:
 2. Build and attach AppImages for x86_64 and aarch64, both from that same wheel
 3. Create a GitHub Release with auto-generated notes
 4. Attach `SHA256SUMS` covering every GitHub asset (wheel, sdist, both AppImages,
-   both Flatpaks, the amd64 snap) and generate build provenance from that
+   both Flatpaks, the amd64 snap, the `.deb` and `.rpm` for both arches) and
+   generate build provenance from that
    manifest (runs after the aarch64 AppImage, both Flatpaks, and the snap land,
    so a partial manifest never gets published)
 5. Publish to PyPI via trusted publishing
@@ -407,8 +409,9 @@ Monitor at: https://github.com/VocaHQ/vocalinux/actions
 
 - [ ] Verify GitHub Release was created correctly
 - [ ] Verify `SHA256SUMS` is attached and lists every GitHub asset (wheel, sdist,
-      both AppImages, both Flatpaks, the amd64 snap) - the release notes tell
-      users to run `sha256sum -c` against it
+      both AppImages, both Flatpaks, the amd64 snap, the `.deb` and `.rpm` for
+      both arches) - the release notes tell users to run `sha256sum -c`
+      against it
 - [ ] If the Store held the snap for `uinput` review, confirm the GitHub `.snap`
       is still attached and the notes document `snap install --dangerous`
 - [ ] After candidate QA (install, tray, mic, model download, typing into a real